CVE-2021-30860

Apple Multiple Products Integer Overflow Vulnerability

High 7.8
Exploited: added to CISA KEV 3 Nov 2021

Description

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Key facts

Published: 24 Aug 2021
Last changed: 21 Oct 2025
Assigned by: apple
KEV added: 3 Nov 2021
KEV fix due: 17 Nov 2021
EPSS: 75.994% likely to be exploited in the next 30 days, higher than 99.537% of CVEs (scores for 15 Nov 2026)
SSVC (CISA): Exploitation: active; Automatable: no; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

7.8CVSS 3.1, Highfrom CISA (ADP container)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What to do

Apply updates per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
Apple	macOS	unspecified up to but excluding 11.6 (affected)
Apple	macOS	unspecified up to but excluding 2021-005 (affected)
Apple	watchOS	unspecified up to but excluding 7.6 (affected)
Apple	iOS	unspecified up to but excluding 14.8 (affected)

Timeline

24 Aug 2021 Published
3 Nov 2021 CVE-2021-30860 added to CISA KEV
3 Nov 2021 Added to the CISA KEV catalogue

Weakness

CWE-190

References

support.apple.comx_refsource_MISC
support.apple.comx_refsource_MISC
support.apple.comx_refsource_MISC
support.apple.comx_refsource_MISC
20210917 APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalinamailing-listx_refsource_FULLDISC
20210917 APPLE-SA-2021-09-13-3 macOS Big Sur 11.6mailing-listx_refsource_FULLDISC
20210917 APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8mailing-listx_refsource_FULLDISC
20210917 APPLE-SA-2021-09-13-2 watchOS 7.6.2mailing-listx_refsource_FULLDISC
20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalinamailing-listx_refsource_FULLDISC
20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8mailing-listx_refsource_FULLDISC
20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6mailing-listx_refsource_FULLDISC
support.apple.comx_refsource_CONFIRM
20210924 APPLE-SA-2021-09-23-1 iOS 12.5.5mailing-listx_refsource_FULLDISC
[oss-security] 20220902 JBIG2 integer overflow fixed in Xpdf 4.04, Poppler 22.09.0mailing-listx_refsource_MLIST
GLSA-202209-21vendor-advisoryx_refsource_GENTOO